CVE-2025-9682 in O2OA
Summary
by MITRE • 08/30/2025
A vulnerability has been found in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_cms_assemble_control/jaxrs/design/appdict of the component Personal Profile Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2025
CVE-2025-9682 represents a cross site scripting vulnerability within the O2OA platform version 10.0-410 and earlier, specifically affecting the personal profile page functionality. This vulnerability resides in the file path /x_cms_assemble_control/jaxrs/design/appdict, indicating a critical flaw in how the application handles user input within its content management system interface. The vulnerability allows remote attackers to inject malicious scripts into the personal profile page, which can execute in the context of other users' browsers when they view the compromised profile. This type of vulnerability falls under CWE-79, which specifically addresses cross site scripting flaws in web applications. The attack vector is particularly concerning as it can be initiated remotely without requiring any special privileges or authentication from the victim, making it a significant threat to user data and application integrity.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to steal session cookies, perform unauthorized actions on behalf of users, or redirect victims to malicious websites. In the context of O2OA's content management system, this flaw could allow adversaries to manipulate user profiles, potentially leading to privilege escalation or data exfiltration. The vulnerability's presence in the personal profile page component suggests that it affects user-facing functionality where individuals might enter or modify information, creating multiple potential entry points for attackers. Given that the exploit has been disclosed and is publicly available, the risk of exploitation is elevated, particularly in environments where users might be tricked into visiting compromised profile pages or where the application serves as a platform for user-generated content.
The technical nature of this vulnerability demonstrates a failure in input validation and output encoding within the application's web interface. The fact that the vendor has acknowledged the issue and committed to fixing it in a new version indicates a recognized security concern that requires immediate attention. Organizations utilizing O2OA should implement immediate mitigations such as web application firewalls, input sanitization measures, and user education regarding suspicious profile content. The vulnerability also aligns with ATT&CK technique T1566, which covers social engineering tactics that can leverage XSS vulnerabilities to compromise user systems. Security teams should monitor for any exploitation attempts and consider implementing Content Security Policy headers to limit the potential impact of such attacks. The remediation process should include thorough code review of the affected component to ensure proper sanitization of user inputs and validation of all data before rendering in the browser context, as recommended by OWASP security guidelines for preventing cross site scripting vulnerabilities.